https://community.splunk.com/t5/Knowledge-Management/How-to-build-a-Splunk-alert-report-using-summary-index/m-p/500062#M4472 <P>Currently I am running the below query to generate a report based on appname,spacename,orgnameand foundation which takes longer to run(for the past 24 hours search). How do I create a summary index to efficiently use this query for faster results?</P> <P>sourcetype="pcf:log" <BR /> | eval report_create_time=strftime(now(), "%Y-%m-%d %H:%M:%S,%3N") <BR /> | eval spanID_ = coalesce(span_id, SPAN_ID, x_b3_spanid, spanId)<BR /> |stats count(spanID_) AS spanCount by report_create_time cf_app_name, cf_space_name, cf_org_name, foundation</P> Wed, 30 Sep 2020 04:42:16 GMT joachimroshan 2020-09-30T04:42:16Z https://community.splunk.com/t5/Knowledge-Management/How-to-build-a-Splunk-alert-report-using-summary-index/m-p/500062#M4472 <P>Currently I am running the below query to generate a report based on appname,spacename,orgnameand foundation which takes longer to run(for the past 24 hours search). How do I create a summary index to efficiently use this query for faster results?</P> <P>sourcetype="pcf:log" <BR /> | eval report_create_time=strftime(now(), "%Y-%m-%d %H:%M:%S,%3N") <BR /> | eval spanID_ = coalesce(span_id, SPAN_ID, x_b3_spanid, spanId)<BR /> |stats count(spanID_) AS spanCount by report_create_time cf_app_name, cf_space_name, cf_org_name, foundation</P> Wed, 30 Sep 2020 04:42:16 GMT https://community.splunk.com/t5/Knowledge-Management/How-to-build-a-Splunk-alert-report-using-summary-index/m-p/500062#M4472 joachimroshan 2020-09-30T04:42:16Z https://community.splunk.com/t5/Knowledge-Management/How-to-build-a-Splunk-alert-report-using-summary-index/m-p/500063#M4473 <P>Populating the summary index with data is easy.</P> <PRE><CODE>(your search)| collect index=your_summary_index </CODE></PRE> <P>However, it does not mean faster with data.It is only faster because the search is performed periodically and the results are created in advance.<BR /> There are disadvantages such as the need to recover manually if the regular execution fails.</P> <P>It's a good idea to compare the pros and cons with "Accelerate reports".</P> <P>I think it's better to "Accelerate reports" that can automatically recover from missing teeth.<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/8.0.2/Report/Acceleratereports">https://docs.splunk.com/Documentation/Splunk/8.0.2/Report/Acceleratereports</A></P> Wed, 25 Mar 2020 15:20:02 GMT https://community.splunk.com/t5/Knowledge-Management/How-to-build-a-Splunk-alert-report-using-summary-index/m-p/500063#M4473 HiroshiSatoh 2020-03-25T15:20:02Z